CIS Service Mapping - ServiceNow Practice Test 2026
Service Mapping questions reward people who understand entry points, patterns, tags, traffic, and application topology. This 270-question bank stays practical and exam-focused. Use it to get comfortable with how maps are actually built.
Price is shown at checkout on Udemy. 30-day money-back guarantee.
Start practicing nowBefore you start: CIS-DF is a prerequisite for this exam from Jan 1, 2027. See the CIS-DF practice test.
Next step: CIS-Discovery / RISCO.
What's included
- 270 questions on entry points, tags, patterns, traffic, and map troubleshooting
- Every answer links to the official ServiceNow documentation so you can verify it yourself.
- Wrong answers are explained too. You see why each option fails, not just which one wins.
- Current for the Zurich release and the 2026 exam blueprint.
- Lifetime access. When new questions are added, you get them at no extra charge.
- Written by an author who passed all 18 ServiceNow exams on the first attempt.
- 30-day money-back guarantee through Udemy.
15 Free Preview Questions
Answer 5 questions free. Enter your email to continue through question 15. The full course has 270 questions on Udemy.
- AThe Mandatory checkbox
- BThe Independent checkbox
- CThe Standalone checkbox
- DThe Override checkbox
Show full explanation
Correct Answer
B - The Independent checkbox
Source
ServiceNow Zurich Documentation
Expert Explanation
CI Identification rules define how the system matches incoming data to existing CIs. The Independent checkbox allows a CI to be inserted or updated without requiring any relationship to other CIs. This is useful for standalone devices or assets that do not depend on a parent CI or connection.
Why the Others Are Wrong
A - There is no Mandatory checkbox on identification rules. C - Standalone is not a valid field name in this context. D - Override relates to reconciliation precedence, not to identification independence.
Memory Tip
Think "Independent means it stands on its own" -- an independent CI does not need friends (relationships) to exist in the CMDB.
Real-World Example
A network scanner discovers a standalone printer that is not connected to any application service. With the Independent checkbox enabled, the printer CI is created in the CMDB immediately without waiting for a relationship to be established.
- AScanning → Classification → Identification → Exploration
- BScanning → Identification → Classification → Exploration
- CClassification → Scanning → Identification → Exploration
- DScanning → Classification → Exploration → Identification
Show full explanation
Correct Answer
A - Scanning > Classification > Identification > Exploration
Source
ServiceNow Zurich Documentation
Expert Explanation
ServiceNow Discovery follows four sequential phases. Scanning finds live devices on the network. Classification determines what kind of device each one is (Windows server, Linux server, router, etc.). Identification matches the discovered device to an existing CI or creates a new one. Exploration then gathers detailed attributes and relationships.
Why the Others Are Wrong
B - Swaps Classification and Identification; you must know what something is before you can match it. C - Puts Classification before Scanning; you cannot classify what you have not found yet. D - Puts Exploration before Identification; you need to know which CI record to populate before you explore it.
Memory Tip
Remember "S-C-I-E" like the start of "SCIENCE" -- Scan, Classify, Identify, Explore.
Real-World Example
Discovery scans subnet 10.0.1.0/24, finds a host responding on port 22. It classifies the host as a Linux server, identifies it as CI "prod-web-01" already in the CMDB, and then explores it to update CPU, memory, and installed software details.
- AService Mapping Advanced
- BService Mapping Plus
- CML Mapping Suite
- DAutomated Service Suggestions App
Show full explanation
Correct Answer
B - Service Mapping Plus
Source
ServiceNow Zurich Documentation
Expert Explanation
Service Mapping Plus is a Store App that builds on top of Service Mapping. It introduces automated service suggestions by analyzing discovered CIs and using machine learning to propose which CIs belong together in a business service. This reduces the manual effort needed to define entry points and map services.
Why the Others Are Wrong
A - "Service Mapping Advanced" is not a real product name. C - "ML Mapping Suite" does not exist. D - The feature description is close, but the actual product name is Service Mapping Plus, not "Automated Service Suggestions App."
Memory Tip
Service Mapping Plus = Service Mapping "plus" intelligence. The word "Plus" signals it is an add-on that gives you something extra on top of standard Service Mapping.
Real-World Example
After running Discovery across your data center, Service Mapping Plus analyzes the relationships and suggests that a group of web servers, an application server, and a database should be grouped as the "Online Banking" business service, saving the team hours of manual mapping.
- Acmdb_key_value
- Bcmdb_tag
- Ccmdb_tag_kv
- Dcmdb_ci_tag_value
Show full explanation
Correct Answer
A - cmdb_key_value
Source
ServiceNow Zurich Documentation
Expert Explanation
When Discovery or cloud integrations pull tag data from cloud providers (AWS, Azure, GCP), the key-value pairs are stored in the cmdb_key_value table. Tag-Based Service Mapping then reads these pairs to automatically group CIs into business services based on matching tag rules.
Why the Others Are Wrong
B - cmdb_tag is not a standard table for this purpose. C - cmdb_tag_kv sounds logical but is not the actual table name. D - cmdb_ci_tag_value is fabricated and does not exist in the platform schema.
Memory Tip
Tags are key-value pairs, and the table is literally named "key_value" -- cmdb_key_value. The name tells you exactly what it stores.
Real-World Example
Your AWS account tags EC2 instances with "app=payments" and "env=prod." Discovery imports these tags into cmdb_key_value. A tag rule in Service Mapping matches all CIs where app=payments and env=prod, automatically building the "Payments Production" service map.
- AOnly the first matching connection section runs
- BConnection sections run before identification sections
- CAll connection sections execute after a successful identification section
- DConnection sections only run if the CI is new
Show full explanation
Correct Answer
C - All connection sections execute after a successful identification section
Source
ServiceNow Zurich Documentation
Expert Explanation
In a Service Mapping pattern, identification sections run first to determine what the CI is. Once identification succeeds, all connection sections in the pattern fire. Each connection section discovers a different type of outbound relationship (such as connections to databases, load balancers, or other application servers).
Why the Others Are Wrong
A - All matching connection sections run, not just the first one. B - Connection sections must wait until identification completes; they cannot run before it. D - Connection sections execute for both new and existing CIs once identification is successful.
Memory Tip
Think of it as "ID first, then connect." A CI must have an identity before it can form connections, and all connections are explored once the identity is confirmed.
Real-World Example
A Tomcat pattern identifies a CI as "app-server-01." After identification, one connection section discovers a MySQL database on port 3306, another finds a Redis cache on port 6379, and a third finds a downstream API. All three connection sections run, building a complete relationship map.
- AReclassification Tasks
- BIdentification Rules
- CDatasource Precedence Rules
- DReconciliation Rules
Show full explanation
Correct Answer
D - Reconciliation Rules
Source
ServiceNow Zurich Documentation
Expert Explanation
Reconciliation Rules within the CMDB Identification and Reconciliation (IRE) engine define data source precedence. An admin configures which data sources are authorized to update specific tables or attributes. When multiple sources try to update the same CI, the reconciliation rule determines which source wins based on its assigned priority.
Why the Others Are Wrong
A - Reclassification Tasks deal with CI class changes, not data source authority. B - Identification Rules handle CI matching logic, not write permissions. C - "Datasource Precedence Rules" is not the official name; the correct term is Reconciliation Rules.
Memory Tip
Reconciliation means "settling differences." When two data sources disagree about a CI attribute, Reconciliation Rules settle the dispute by picking the authorized winner.
Real-World Example
Both Discovery and a SCCM import try to update the OS version on server CIs. A Reconciliation Rule gives Discovery higher precedence for OS-related attributes, so Discovery data always wins when there is a conflict.
- ACandidate List
- BUnmapped Servers
- CService Health Dashboard
- DService Groups
Show full explanation
Correct Answer
B - Unmapped Servers
Source
ServiceNow Zurich Documentation
Expert Explanation
The Service Mapping Workspace provides operational visibility into your service mapping environment. The Unmapped Servers widget specifically lists servers that Discovery has found but that do not belong to any business service map. This helps administrators prioritize which servers need to be included in service mapping efforts.
Why the Others Are Wrong
A - Candidate List is not the correct widget name in the workspace. C - The Service Health Dashboard focuses on service health metrics, not mapping coverage. D - Service Groups organize services but do not surface unmapped infrastructure.
Memory Tip
The name says it all: "Unmapped Servers" shows servers that are not yet mapped. Simple and direct.
Real-World Example
After a large Discovery scan of your data center, you open the Service Mapping Workspace and see 47 servers in the Unmapped Servers widget. You use this list to create entry points and begin mapping those servers into their respective business services.
- AAt least one validated MID Server
- BAt least one tag rule
- CWorking credentials for needed protocols
- DA published pattern for every technology in scope
Show full explanation
Correct Answer
A and C - At least one validated MID Server and working credentials for needed protocols
Source
ServiceNow Zurich Documentation
Expert Explanation
The Service Mapping Home page displays prerequisite readiness indicators. Two key items must show as "ready" before mapping can begin: a validated MID Server (the component that executes probes on the network) and working credentials for the protocols you need (SSH for Linux, WMI/WinRM for Windows, SNMP for network devices). Without these two essentials, mapping cannot function.
Why the Others Are Wrong
B - Tag rules relate to Tag-Based Service Mapping, an optional feature, not a core prerequisite. D - Patterns are important but many come pre-installed; the Home page does not require a published pattern for every technology as a prerequisite.
Memory Tip
To map anything, you need a "messenger" (MID Server) and a "key" (credentials). No messenger, no delivery. No key, no door opens.
Real-World Example
You open the Service Mapping Home page and see a green checkmark next to "MID Servers" because mid-prod-01 is validated. You also see green next to "Credentials" because SSH credentials for Linux and WMI credentials for Windows have been tested successfully. You are ready to start mapping.
- A0
- B1
- C'-1
- DIt depends on a setting
Show full explanation
Correct Answer
A - 0
Source
ServiceNow Zurich Documentation
Expert Explanation
When using Regex Parse (Parse variable) in a pattern, capture group 0 always returns the entire string matched by the full regular expression. Groups 1, 2, 3, etc. return the content captured by each set of parentheses in the regex. This is standard behavior inherited from Java regex conventions used by the ServiceNow platform.
Why the Others Are Wrong
B - Group 1 is the first sub-group captured by parentheses, not the entire match. C - Negative group numbers are not valid. D - Group 0 always means the full match; this is not configurable.
Memory Tip
Group 0 = the "whole thing." Zero encompasses everything. Sub-groups start at 1.
Real-World Example
A pattern runs a command that returns "Version: 8.5.42" and uses the regex "Version: (\d+)\.(\d+)\.(\d+)." Group 0 gives "Version: 8.5.42," group 1 gives "8," group 2 gives "5," and group 3 gives "42."
- ASSH
- BWMI
- CSNMP
- DWinRM
Show full explanation
Correct Answer
A and C - SSH and SNMP
Source
ServiceNow Zurich Documentation
Expert Explanation
Patterns targeting Linux systems rely primarily on SSH to run shell commands and collect configuration data. SNMP is also commonly used to gather system and network information from Linux hosts, especially for metrics like interface statistics, system uptime, and hardware details. Together, these two protocols cover the majority of Linux discovery needs.
Why the Others Are Wrong
B - WMI is exclusive to Windows environments and cannot be used on Linux. D - WinRM is a Windows-specific protocol for remote management and has no role in Linux discovery.
Memory Tip
Linux loves "S" protocols: SSH for shell access and SNMP for monitoring data. Windows uses "W" protocols: WMI and WinRM.
Real-World Example
A pattern connects to a Linux application server via SSH on port 22 to run "ps aux" and discover running processes. It also queries the server via SNMP on port 161 to collect CPU utilization and network interface statistics for the CI record.
- AReduce alert noise through correlation and deduplication
- BAccelerate incident response through automated alert-to-incident creation
- CGain visibility into service health via Service Mapping integration
- DIntegrate with existing monitoring tools into one platform
- EReplace all existing monitoring tools entirely
- FEliminate the need for a CMDB
Show full explanation
Correct Answer
A, B, C, and D
Source
ServiceNow Zurich Documentation
Expert Explanation
Event Management provides four core value propositions for customers. It reduces noise through correlation and deduplication (A). It speeds up incident response via automated alert-to-incident workflows (B). It integrates with Service Mapping to show service-level impact (C). It consolidates alerts from many monitoring tools into a single platform (D). These four capabilities together make the business case for Event Management.
Why the Others Are Wrong
E - Event Management complements monitoring tools; it does not replace them. Organizations keep their existing tools and feed alerts into ServiceNow. F - The CMDB is essential for Event Management to correlate events to CIs and services. Removing it would break the core value of the product.
Memory Tip
Event Management is an "integrator, not a replacer." It brings everything together (A through D) but never claims to eliminate your existing tools or data stores (E and F).
Real-World Example
A company uses Nagios for network monitoring, Datadog for APM, and SolarWinds for server monitoring. Event Management receives alerts from all three, deduplicates repeat alerts about the same disk failure, correlates them to the affected business service via Service Mapping, and automatically creates a P2 incident assigned to the storage team.
- AEntry Point > Host Detection > Classification > Identification > Connection
- BScanning > Classification > Identification > Exploration
- CEntry Point > Scanning > Exploration > Connection
- DClassification > Scanning > Entry Point > Identification
Show full explanation
Correct Answer
A - Entry Point > Host Detection > Classification > Identification > Connection
Source
ServiceNow Zurich Documentation
Expert Explanation
Service Mapping begins with an Entry Point that specifies the starting CI (such as a URL or IP). Host Detection then resolves the entry point to a target host. Classification determines what type of CI the host is running. Identification matches it to an existing CMDB record or creates a new one. Connection discovers outbound relationships to other CIs, building the full service map.
Why the Others Are Wrong
B - These are Discovery phases (Scanning > Classification > Identification > Exploration), not Service Mapping phases. C - Missing Classification and Identification phases. D - The order is completely wrong; Classification cannot precede the Entry Point.
Memory Tip
Service Mapping flow: "Enter, Host, Class, ID, Connect" -- you Enter a building, find the Host, check their Class, verify their ID, and then make Connections.
Real-World Example
You create an entry point for URL "https://payments.company.com." Service Mapping resolves the hostname to IP 10.0.5.20 (Host Detection), determines it runs Apache Tomcat (Classification), matches it to CI "payments-web-01" (Identification), and then follows outbound connections to a PostgreSQL database and a Redis cache (Connection).
- AOpen protocol ports from the MID to the target (e.g., 22, 135/445, 161)
- BIncrease the MID JVM heap
- CPlace a MID Server in the same network zone
- DRaise the instance’s node count
Show full explanation
Correct Answer
A and C - Open protocol ports from the MID to the target, and place a MID Server in the same network zone
Source
ServiceNow Zurich Documentation
Expert Explanation
When mapping fails at the first hop due to a firewall, the root cause is network connectivity between the MID Server and the target. Two solutions address this directly: opening the specific protocol ports in the firewall, or deploying a MID Server on the same side of the firewall as the target device so no firewall stands between them.
Why the Others Are Wrong
B - JVM heap size is a memory tuning parameter and has nothing to do with firewall or port access issues. D - Node count is an instance-level scaling setting that does not affect network path connectivity.
Memory Tip
Firewall blocking? Two fixes: "punch a hole" (open ports) or "jump the wall" (put a MID Server on the other side).
Real-World Example
A database server in a DMZ cannot be reached by the corporate MID Server. The network team either opens port 1521 (Oracle) through the firewall from the MID to the DB server, or deploys a second MID Server inside the DMZ to handle mapping of all DMZ assets.
- ACredentials inserted and tested
- BGather info about the applications
- CInsert all network devices
- DService Mapping plugin installed
- EDiscuss with SMEs
Show full explanation
Correct Answer
A, B, D, and E
Source
ServiceNow Zurich Documentation
Expert Explanation
Before starting Service Mapping, four key preparations are needed. Credentials must be created and tested (A). Information about target applications must be gathered to define proper entry points (B). The Service Mapping plugin must be installed (D). SMEs should be consulted to understand application architectures and dependencies (E). These steps ensure mapping runs smoothly and produces accurate results.
Why the Others Are Wrong
C - You do not need to pre-insert all network devices. Service Mapping discovers devices as part of its operation. Pre-loading them is not a prerequisite and could actually create duplicate records if not done carefully.
Memory Tip
Preparation checklist: "Plugin, People, Passwords, and Plans" -- install the Plugin, talk to People (SMEs), set up Passwords (credentials), and Plan by gathering app info.
Real-World Example
Before mapping the HR application, the team installs the Service Mapping plugin, creates SSH and WMI credentials for the servers, meets with the HR application team to learn the architecture (two web servers behind a load balancer connecting to an Oracle database), and tests all credentials to confirm they work.
- A“MID Server Properties” documentation
- B“Prerequisites for Service Mapping” guide
- C“Components installed with Service Mapping” reference
- D“Quick Start Tests for Service Mapping” guide
Show full explanation
Correct Answer
A - "MID Server Properties" documentation
Source
ServiceNow Zurich Documentation
Expert Explanation
The "MID Server Properties" documentation provides a comprehensive list of all configurable properties that control MID Server behavior. These include settings for thread pools, connection timeouts, maximum payload sizes, probe execution parameters, and communication intervals with the instance. This is the go-to reference for tuning MID Server performance.
Why the Others Are Wrong
B - The Prerequisites guide focuses on setup requirements, not property-level configuration. C - The Components reference describes installed artifacts (tables, modules, plugins), not runtime properties. D - The Quick Start Tests guide helps validate the setup but does not document MID Server properties.
Memory Tip
If you want to know what properties control the MID Server, look at the document literally called "MID Server Properties." The answer is in the title.
Real-World Example
A MID Server is timing out when mapping large environments. You consult the "MID Server Properties" documentation and find the mid.max.threads property to increase parallel probe execution, and the mid.connection.timeout property to extend the timeout for slow-responding targets.
Free exam updates. No spam. Unsubscribe anytime.
Prefer to skip the email? Get all 270 questions on Udemy. 30-day money-back guarantee.
You scored 0/15 on the 15-question preview.
The full course keeps the same answer breakdown style across all 270 questions.
A failed exam attempt costs $225 to retake.
Many students also study:
Compare all 18 practice tests, or use the cert quiz to plan what to study next.
Common questions
How many questions are in the full SM practice test?
The full course has 270 questions on Udemy. Every answer option has its own explanation, and the explanations link to official ServiceNow documentation.
Is there a refund if the course is not right for me?
Yes. Udemy courses come with a 30-day money-back guarantee.
Will this practice test guarantee I pass?
No. Practice tests show you where you are weak. They do not replace hands-on work, so pair them with a free ServiceNow Personal Developer Instance.
How much does the real SM exam cost?
The exam costs $450 for a first attempt and $225 for a retake. Fees can change, so check ServiceNow University before you register.
Do I need CIS-DF before SM?
Yes. From January 1, 2027 you cannot register for this exam without CIS-DF. If you already hold this certification, you must pass CIS-DF by December 31, 2026. See the CIS-DF practice test.
Which certification should I take first?
Most people start with CSA. If you are unsure, take the 2-minute recommendation quiz or read the certification path guide.
Read the full SM study guide for domain weights, a study plan, and common mistakes.
Next step after SM: CIS-Discovery / RISCO. Not the right exam? Take the 2-minute quiz or compare all 18.
Browse all 18 practice tests →